fix: add git credentials for tag push in release workflow (AST-163939)#217
Open
cx-atish-jadhav wants to merge 1 commit into
Open
fix: add git credentials for tag push in release workflow (AST-163939)#217cx-atish-jadhav wants to merge 1 commit into
cx-atish-jadhav wants to merge 1 commit into
Conversation
The 'Push tag' step was failing with 'fatal: could not read Username for https://github.com: No such device or address' because persist-credentials: false on the checkout step removes the ephemeral GITHUB_TOKEN credential from .git/config. Re-establish git authentication by setting the remote URL with a token before git pull/tag/push. This maintains supply-chain security (keeps the token window minimal, only during the push step) while fixing the credential gap. Fixes release workflow failures when inputs.dev == false (production releases). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
cx-aniket-shinde
approved these changes
Jul 22, 2026
cx-atish-jadhav
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The 'Push tag' step in the release workflow was failing with:
This prevented production (non-dev) releases from succeeding.
Root Cause
Commit c04c499 ("Fix unit test cases", Jul 12) replaced
fetch-depth: 0withpersist-credentials: falseon the release job's checkout step. While this correctly prevents the ephemeralGITHUB_TOKENfrom being cached on disk during the vulnerablenpm ciandnpm run buildphases (reducing supply-chain attack surface), it left no credential for the latergit push --tagsstep.Solution
Before
git pull/tag/push, re-establish authentication by setting the remote URL with the token:git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${REPO}"This maintains security (token window remains minimal, only during the push step) while fixing the credential gap.
Testing
Ready to re-trigger the release workflow once this merges to main.
🤖 Generated with Claude Code